Disrobe

Disrobe is a static decompiler, deobfuscator, and unpacker. It strips packing and obfuscation from compiled software one layer at a time and recovers the source code or the original bytes underneath.

Give disrobe auto an executable, an app package, a script, or a firmware image. It names each layer (installer, archive, packer, freezer, protector, obfuscator, bytecode), removes it with the matching recovery pass, and runs again on what that pass produced until no pass recognizes what is left. One Rust binary covers Python, JavaScript and WebAssembly, Java and Android, .NET, native PE, ELF, and Mach-O code, Go, Lua, PHP, Ruby, Erlang and Elixir, ActionScript, shell scripts and Office macros, React Native and Flutter apps, installers, and firmware. disrobe catalog lists the 170 packers, protectors, obfuscators, and bytecode families it recognizes across 15 ecosystems.

The engines are built in. Python bytecode decompiles without a Python installation, JavaScript recovery needs no Node.js, and the Java, Android, and .NET decompilers need no JVM or .NET SDK; with the default --backend auto, jvm decompile and dotnet decompile use an installed external decompiler first. Disrobe does not launch the program it analyzes unless you pass --allow-dynamic, which applies only to PyArmor v6 and v7. The safety model lists the bounded interpreters that evaluate code taken from an input and the host tools Disrobe starts.

It is built for malware analysts, reverse engineers, incident responders, CTF players, and security researchers.

License: Disrobe Source-Available License 1.1. Personal hobby projects and learning, unpaid independent security research, nonprofit education and research, and journalism are free, as the license defines them. Any use by or for a company requires a paid license.

Quick start · What it recovers · Measured results · How it works · Safety model · Documentation

Quick start

Download the archive for your platform from GitHub Releases, check it against SHA256SUMS, and put disrobe (disrobe.exe on Windows) on your PATH. Then run:

disrobe identify suspect.exe                # compiler, packer, and protector, with evidence
disrobe auto suspect.exe --out recovered/   # remove the layers Disrobe can recover
disrobe context --out recovered/            # what each pass recovered, and at what confidence

Recorded output of identify and the unpacking step, run on a UPX-packed Rust program committed to this repository (corpus/native/packers/upx/hello.packed.nrv2b.exe):

$ disrobe identify hello.packed.exe
format: pe64 (64-bit) subsystem=windows-cui
packer     UPX  (96%)  -> disrobe native unpack
             - [section UPX0] UPX characteristic section
             - [section UPX1] UPX characteristic section
             - [section UPX2] UPX characteristic section
             - [byte scan] UPX packer magic
...

$ disrobe native unpack hello.packed.exe --out recovered/hello.bin
native unpack: OK
  input:        hello.packed.exe
  packer:       upx
  status:       Implemented
  packed_size:  53248
  recovered:    116810 bytes
  wrote:        recovered/hello.bin

The unpacking benchmark recovers the same file and compares it with the original build: the .text section is byte-identical, 73,160 bytes with no differences (unpacking measurements).

Release archives cover Windows (x86-64, ARM64), macOS (x86-64, ARM64), and Linux (x86-64 and ARM64 with glibc, static x86-64 with musl). Each archive has a separate cosign signature bundle, and SECURITY.md explains the check. Building from source needs the Rust toolchain pinned in rust-toolchain.toml (1.96.1; the minimum supported version is 1.95) and a C toolchain for native dependencies:

git clone https://github.com/1-3-7/disrobe
cd disrobe
cargo build --locked --release -p disrobe-cli --bin disrobe

The installation guide covers feature flags and the optional external backends. Run disrobe doctor to probe 46 to 51 external tools depending on the platform and see which optional backends are installed.

What it recovers

Each row names the formats Disrobe reads and the protection it removes. Where disrobe catalog lists a family, the level shown is the catalog's. Families named first are recovered. Partial families are peeled as far as the input allows, and the result names what is left. Detect only families are identified, and the result states why the rest cannot be recovered, usually because a key exists only at run time. A name in bold is graded on output of the real tool, committed to this repository; the other names are graded on samples written for the tests, or are only detected. Each ecosystem links to its guide.

Measured results

Most figures below come from a committed test that compares Disrobe's output with an independent reference: a compiler, a runtime, a verifier, the original file, or another tool's output. Rows graded coverage-self-reported count Disrobe's own output. The populations are small and named, so a figure describes its population and not every input of its kind. CI last measured the push and weekly rows at commit d9bb5f59, in runs whose only failures were the graphs job and the macOS and Windows shards of one test group. The latest release, v0.10.6, predates some of these figures, so build from source to reproduce one. The evidence records give the fixtures, reference, and reproduction command for each figure that has a descriptor.

The grades: strong means an independent reference could have rejected the output (execution, byte identity, a verifier, or an external tool); recompile-only means a real compiler accepted the output, with no behavioural check; coverage-self-reported means the count comes from Disrobe's own counters. In the Runs column, push is every push to main, weekly is the scheduled weekly run and release tags, and local means that no CI job provisions the input, so the committed test re-measures the figure where it runs.

Python decompilation, per interpreter. Each interpreter compiles the same pinned list of 200 standard-library modules. A code object counts when the recovered source recompiles to the same normalized opcode structure. Jump targets and most operands are not compared, and modules an interpreter does not ship leave its denominator, so the rows are not a ranking.

A wider CPython 3.14.5 population of 574 core modules gives 17396 of 18276 matching code objects (95.18%, local). Pinned result · Full-population result.

Other ecosystems.

Against other tools on the same input. Each pair runs Disrobe and another tool on the same input and grades both outputs the same way. In the Java rows each tool emits its own set of regions, so the counts are not a ranking; the APKLeaks row counts exact matches of eight secrets planted in one APK.

These comparisons are re-measured weekly and on pushes that touch their evidence paths. Inputs, raw tool output, and reproduction commands.

Evidence records.

How it works

disrobe auto fingerprints the input, runs the pass with the highest confidence, then fingerprints that pass's output and every child it extracted, and repeats. It stops when no pass clears the confidence threshold, when a content hash repeats, or at the depth limit (8 by default, --max-depth). Given a directory, it processes the files under it recursively, skipping hidden directories and symbolic links. The end-to-end tests follow chains such as a PyInstaller archive whose .pyc children go on to the decompiler, a PyArmor v8 wrapper inside a PyInstaller archive, and a UPX-packed Rust executable that unpacks and then yields demangled Rust symbols.

disrobe auto app.exe --out recovered/ --capture-stages   # keep each stage's exact output
disrobe auto samples/ --out batch/ --jobs 4              # a whole directory, four workers
disrobe chain module.pyc --chain py.decompile --out src/ # a pass list you choose
disrobe passes                                           # every registered pass

Each auto or chain output directory holds chain.json (disrobe.chain/v1), which records the topology, the chosen passes, their confidence, and a BLAKE3 hash of every stage, and recovery.json (disrobe.recovery/v1), which records each pass's verdict and timing. auto also writes report.sarif, whose run properties embed a STIX 2.1 bundle. The global flags --json, --ndjson, and --sarif switch output to JSON, streaming JSON, or SARIF 2.1.0, and disrobe report renders a finished run as text, JSON, Markdown, HTML, or SARIF.

Given the same input, flags, build, and installed formatters, the recovered files are the same whatever the worker count, unless one of the time limits below ends a step early; the weekly run compares --jobs 1 with --jobs 4 on a batch of three fixtures. The run records (chain.json, recovery.json, report.json, and report.sarif) also record each pass's duration and the worker count, and their timestamps are fixed only when SOURCE_DATE_EPOCH is set. These steps stop on elapsed time rather than a step count, so a heavily loaded machine or a higher --jobs can change their output: JavaScript string-array probes run one at a time across all workers, are refused after waiting 30 seconds for their turn, and stop after 4 seconds (a rotation search after 180 seconds); the JSFuck, aaencode, jjencode, and JSFiretruck decoders stop after 30 seconds; the Dalvik interpreter after 750 milliseconds; PHP decoding loops after 2 seconds; the two Go garble scans after 8 seconds each; formatters after 5 seconds; and mixed boolean-arithmetic simplification and VM devirtualization after 250 milliseconds per solver query, 5 seconds in total, 750 milliseconds per SMT check, and one minute per binary for the devirtualization that native decompile runs unless --no-devirt is given.

Pass list · Chain runner · Reading a result · Batch processing · Run reports

Safety model

Disrobe is built to open hostile files, but it is not a sandbox. Run it on inputs you are allowed to analyze, in an environment you would trust with them.

Only the PyArmor v6/v7 dynamic hook runs sample code natively, behind --allow-dynamic with a watchdog. --allow-bcc permits only in-tree static analysis and does not execute the sample or invoke external tools.

Apart from prowl, which queries public web archives and threat-intel services, serve, which listens for requests, and install, install-deps, and doctor --auto-install, which download tools, commands make no network requests. Parsers bound their input size, allocation, recursion, and output, with two known exceptions: JavaScript unbundling limits neither its input size nor its module count or output size, and the committed 7.35 MiB JSFuck file corpus/js/jsfuck/obfuscated.megafile.js overflows the stack of the embedded JavaScript engine and ends the process, as the behaviour gate records. --i-have-authorization gates the commercial JavaScript protector transforms, lua deob for MoonSec v3 and IronBrew2, php decode for ionCube, SourceGuardian, and Zend Guard input, and the decryption-key metadata category; auto applies the Lua transforms without it. The threat model describes the trust boundaries, and SECURITY.md explains how to report a vulnerability.

Use it from other tools

Commands

disrobe <command> --help is the reference for your build, and the CLI reference covers every subcommand. disrobe explain <code> describes a DR-* diagnostic.

Limits

• Compilation discards comments, formatting, and many names and types, so recovered source is a reconstruction. The tables above say how each kind of output is checked.
• Recognition is broader than recovery. A catalog match can come with partial output, so read the level and the result's own report.
• A key derived at run time, a payload fetched from the network, or a name-hashing seed cannot be recovered from a file that does not contain it.
• Commercial virtualizers such as VMProtect, Themida, and WinLicense are detected, not unpacked or devirtualized.
• Native decompilation covers x86-64, AArch64, ARM32, and MIPS32. ARM32 and MIPS32 output is checked for the operations it contains, not for equivalent behaviour, and 32-bit x86 is only disassembled.
• Scale is unmeasured for large inputs: the largest committed WebAssembly module is 17,173 bytes, and no figure covers bundles in the tens of megabytes.

Documentation

• Documentation site, with the quickstart, the result guide, and the family catalog.
• Evidence harness and evidence records.
• Contributing guide, threat model, security policy, and legal considerations. Whether you may analyze a given artifact depends on your circumstances.

License

Disrobe is proprietary, source-available software under the Disrobe Source-Available License, Version 1.1. The relicensing notice explains how it relates to earlier terms.

Personal hobby projects, personal learning, unpaid independent security research by individuals, nonprofit education and research, and bona fide journalism are free, as defined in the license. Any use by or for a company requires a paid license. See commercial licensing.

Required credit: This work used Disrobe, created by 1-3-7: https://github.com/1-3-7/disrobe

Forks other than contribution forks, reposting, rebranding, resale, hosting, and competing development are prohibited. The software is provided as is, at the user's own risk. See attribution, contributor terms, the license summary, and the notice.

Copyright (c) 2025-2026 1-3-7. All rights reserved.